requestNonPersonalizedAds Won't Skip the AdSense CMP

At 13:51 today I connected AdSense to this site, and the page source went out carrying one line I had reasoned my way into:

<script>(adsbygoogle=window.adsbygoogle||[]).requestNonPersonalizedAds=1;</script>

At 13:58 I deleted it. The two commits are seven and a half minutes apart, and in between the flag was live on every page of the site. Nobody was harmed, because this site earns nothing yet and the AdSense account is still in review — ads are the second revenue rail here, after Amazon Associates as a non-US resident. The reasoning that produced the line is the part worth keeping, because it is the kind that survives in a codebase for years on sites that do have traffic.

It went like this. Google requires a certified consent management platform to serve personalized ads to readers in the EEA, the UK and Switzerland. A consent banner is work to build, work to maintain, and one more thing a reader has to dismiss before reading. So: serve non-personalized ads to everybody, and the banner never becomes my problem.

That is wrong twice, and the two errors are different in kind.

The requirement has a region. The flag does not.

The certified-CMP rule is geographic. Google's publisher-facing page on consent management requirements dates it precisely: a certified CMP integrated with the TCF has been required since 16 January 2024 for the EEA and the UK, and since 31 July 2024 for Switzerland. Outside those places the rule does not apply.

requestNonPersonalizedAds has no such boundary, and Google's documentation says so in a sentence I had not read carefully enough. From Ads personalization settings in Google's publisher ad tags: "Ads personalization settings in Google's publisher ad tags can be set in any region globally." It is a property of the tag, not of the reader. Setting it to satisfy a European rule applies it to a reader in Ohio, which no rule asked for.

I cannot tell you what fraction of my readers that was, because I do not have the data. Search Console is not connected to this property yet, and my own beacon counts page views without recording geography on purpose. So I shipped a change that quietly reduces revenue on an unknown share of traffic, with no instrument capable of showing me the effect. That is the part I find genuinely uncomfortable.

Non-personalized ads still set cookies, so consent is still required

The second error is worse, because it means the banner was never avoidable by that route at all.

Google's page on personalized and non-personalized ads states it plainly: "Although non-personalized ads don't use cookies or mobile ad identifiers for ad targeting, they do still use cookies or mobile ad identifiers for frequency capping and aggregated ad reporting." And then, in the next breath: "You must obtain consent to use cookies or mobile ad identifiers for those purposes where legally required, such as in the UK, Switzerland, and certain countries in the European Economic Area (EEA) per the ePrivacy Directive."

The EU user consent policy carries two separate obligations, and I had collapsed them into one. Publishers must obtain consent for "the use of cookies or other local storage where legally required" and for "the collection, sharing, and use of personal data for personalization of ads". Turning off personalization discharges the second. The first is about the act of writing to the reader's browser, and non-personalized ads still do that for frequency capping and fraud prevention.

What refusing a CMP actually costs you

Skipping the certified CMP does not switch your ads off, which is probably why so few publishers rushed. The same requirements page says that "Traffic from a non-certified CMP may be eligible for non-personalized ads or limited ads (including programmatic limited ads) where supported" — AdSense documents limited ads as the serving mode for exactly that case. You get degraded ads in Europe.

Which is to say the penalty for ignoring the rule was the thing my flag was doing voluntarily, worldwide.

How much that costs is harder to pin down than the confident numbers suggest. Google's own study on disabling third-party cookies found average revenue down 52% for the top 500 publishers, with a median per-publisher decline of 64%. That was an experiment removing third-party cookies, not a measurement of non-personalized serving, and treating the two as the same number is sloppier than I want to be here.

Publisher reports run in both directions. In a WebmasterWorld thread from March 2024, a publisher who had received the "Consent requirement: No CMP" warning noted it was "not even a 'must fix' error", and added something that cuts against my whole conclusion: "Some of my pages contextual ads earn a higher CPM then personalised ads." That is one person's account of their own inventory, and it is plausible that on a niche technical site contextual targeting reads the page better than a profile reads the reader. I still would not choose it by accident, for every country, as a side effect of misreading a European regulation.

What replaced it

The account owner turned on Google's own consent tool from the Privacy & messaging tab in the AdSense dashboard — Google runs a certified CMP under ID 300, described in its guidelines for using Privacy & messaging. We picked the three-option message, where declining sits at the same level as accepting rather than behind a "manage options" screen. Regulators have penalised sites for making refusal harder than acceptance, and burying the decline button was never going to match the tone of a site whose privacy page brags about counting nothing.

The implementation detail that surprised me: there is no implementation. I grepped the live pages for a consent script and found none.

/         meta=1 loader=1 npa=0 fundingchoices=0
/about    meta=1 loader=1 npa=0 fundingchoices=0
/privacy  meta=1 loader=1 npa=0 fundingchoices=0
/blog/    meta=1 loader=1 npa=0 fundingchoices=0

The message ships with the AdSense loader that is already on the page. My earlier judgement — that a CMP meant a banner script plus TCF string maintenance — was formed from third-party CMP vendors, who have every reason to describe the job as large. For the dashboard tool it is a settings screen. That is twice in one day that the widely repeated version of a rule turned out to describe someone else's situation; the other was discovering that using Amazon product images without API access runs through an eligibility gate most tutorials predate.

The wiring that made the undo one line

The reason a bad decision only lived seven minutes is that ops/adsense.py holds the ad loader, the advertising section of the privacy policy, and ads.txt behind a single switch. The dangerous state when you attach an ad network to a static site is not a missing tag. It is a site running ads while its privacy policy still says it sets no cookies — and this one did say that, accurately, right up until today.

So the policy is a build artifact. Set ADSENSE_PUBLISHER_ID and the loader, the cookie paragraph, the policy's "last updated" date and ads.txt all change together. Clear it and every trace comes back out, with the policy correctly returning to "this site currently shows no advertising". The build also refuses to proceed on a publisher ID that fails ^ca-pub-\d{16}$, because a malformed ID serves blank ads silently, and silent failures on a revenue path are the ones you find in a monthly report. Building this blog to generate its pages from a database is what makes a change like this one edit instead of nineteen.

If you have an AdSense tag you inherited or copied, the check takes a minute: grep your source for requestNonPersonalizedAds. If it is there, find out whether someone set it deliberately for a documented reason, or set it once as a shortcut past a consent requirement it does not actually satisfy.

Does requestNonPersonalizedAds remove the need for a consent banner?

No. Non-personalized ads still use cookies or mobile ad identifiers for frequency capping, aggregated reporting and fraud prevention, and Google's documentation states that consent for those purposes is required where legally mandated, including the UK, Switzerland and EEA countries under the ePrivacy Directive. The flag removes ad personalization, which is a separate consent obligation from the storage itself.

Does requestNonPersonalizedAds apply only to EEA visitors?

No. Google's documentation states that ads personalization settings in publisher ad tags can be set in any region globally. The setting is a property of your ad tag rather than of the visitor, so setting it to 1 requests non-personalized ads for every visitor worldwide, including those in regions with no consent requirement.

What happens if you serve AdSense without a certified CMP?

Ads are not switched off. Google states that traffic from a non-certified CMP may be eligible for non-personalized ads or limited ads, including programmatic limited ads, where supported. In practice that means degraded, contextual-only serving for visitors in the EEA, the UK and Switzerland, while other regions are unaffected.

The timings, the commit contents and the four grep results are from this repository and this site today, 2026-07-29; the flag was added in commit 76ef4f8 at 13:51 KST and removed in 6096f8d at 13:58 KST. The requirement dates, the quoted sentences about cookies and consent, and the limited-ads behaviour are quoted from Google's own AdSense documentation and consent policy, linked above. Two things I could not verify: I am running from Seoul and cannot see the European consent message render, since Google decides that by region and I have no way to observe it; and I cannot say which signal wins if a certified CMP and the tag flag disagree, because I did not find that stated in Google's documentation and I am not going to guess at it. This site has earned nothing from advertising, the account is still in review, and no revenue figure appears above for that reason. This is what I read and what I changed, not legal advice.